Strong Password Generator

What is a password generator and how does this one work?

A password generator picks an unpredictable string of characters for you. People who invent passwords drift toward birth years, pet names and keyboard runs. That is also why attackers' wordlists try exactly those habits first. So the real value lies in handing the choice to a cryptographic source of randomness.

I held this tool to three rules:

• Only the browser's cryptographic generator: every character comes from crypto.getRandomValues. The tool never touches the predictable Math.random function.
• No modulo bias: when a 32-bit random number does not divide evenly into the pool size, the tool draws again. As a result, every character has exactly the same chance.
• Nothing reaches a server: the password exists only on your screen. The Copy link button writes the length and type settings into the address, never the password itself.

In the result panel, digits and symbols appear in a different colour from letters. The colours only help you read; the text you copy stays plain.

How long should a password be according to NIST?

The clearest length guidance comes from NIST, the US standards body. Its SP 800-63B-4 guideline from August 2025 sets out these points:

• As the only factor, a password needs at least 15 characters. Within multi-factor authentication, 8 is the floor.
• Systems should allow passwords of at least 64 characters. This tool also generates up to 64.
• Systems should not impose composition rules such as mixing character types. Instead, they should compare new passwords against lists of breached and commonly used ones.

In the UK, the NCSC takes a practical angle and suggests combining three random words for passwords you must remember. For everything else, a manager plus a generated password does the job.

My own rule of thumb: 16 characters or more in a password manager, 20 or more for admin and email accounts. For a Wi-Fi network you type by hand, for example, choose Easy to type. Then share it with guests through a Wi-Fi QR code. In short, settle the length first and think about types second.

What does entropy in bits actually measure?

Entropy tells you, in bits, how many possibilities a password comes from. Each extra bit doubles the number of guesses an attacker faces. Therefore the ten-bit gap between 80 and 90 bits means a search space roughly a thousand times larger.

The calculation line in the tool spells this out. On the Standard preset, for instance, you see 16 × log₂(86) + log₂(0.851) = 102.6 bits. The first term comes from pool and length; the second is the small cost of the one-from-each-type rule.

There is an important limit here. The figure only means something for randomly generated passwords. Take a home-made password such as London2012!. It looks long, but attackers guess it pattern by pattern, so its real entropy is tiny. That is why the tool never rates a password you type in; it only scores what it generated itself.

The strength badge follows the same number: above 80 bits counts as strong and above 110 bits as very strong. The crack time card then turns that entropy into time. Still, no time estimate protects a password that leaked in a breach or went into a phishing page.

Why is the one-from-each-type rule on by default?

Plenty of sign-up forms still demand at least one digit or symbol. However, a purely random password does not always meet that demand. With all four types selected, a 16-character one has roughly a 14 percent chance of containing no digit. When a form rejects it, people fix it by hand, and the digit they add is usually a 1 at the end.

For that reason I left the rule switched on. The tool draws a whole candidate first; if any selected type is missing, it throws the entire candidate away and starts over. It never drops a missing character into a random slot, so every password that satisfies the rule stays equally likely.

The rule has a price, but a small one:

• 16 characters, all four types: from 102.8 bits down to 102.6 bits.
• 8 characters, all four types: from 51.4 bits down to 50.4 bits.
• With a single type selected, nothing changes.

NIST advises systems against such composition rules. That said, you cannot change the form in front of you; you just need your password accepted. If a site refuses symbols altogether, untick the symbol box and add a few characters of length instead.

When should you use Easy to type and exclude ambiguous characters?

Not every password goes in through copy and paste. On a smart TV, a games console, a printer or a guest Wi-Fi network you type it letter by letter on an on-screen keyboard. Sometimes you even read it out over the phone. In those moments people confuse l and 1, I and l, or O and 0. One wrong character then costs minutes.

Easy to type exists for exactly this job:

• It sets 20 characters.
• It uses letters and digits only and switches symbols off.
• It removes the ambiguous characters (l, 1, I, O, 0), which leaves a 57-character pool and 116.6 bits.

Removing those characters costs very little. With all four types at 16 characters, the pool shrinks from 86 to 81. Entropy then drops from 102.6 to 101.1 bits, a loss of about 1.4 percent.

On the other hand, for accounts where you only ever paste, you can leave the option off without any downside. The monospace font and the colours in the result panel also help you tell similar characters apart. Moreover, if you share a Wi-Fi password as a QR code instead of reading it aloud, typos disappear altogether.

Where should you store a password from a password generator?

A strong password is at its weakest the moment it leaves the screen. If you paste it into an email, a chat or a notes file on your desktop, all the effort goes to waste. My advice points to one place: a password manager.

• Password manager: the only sustainable way to keep a separate, long password for every account. You remember just the master password.
• Two-factor authentication: protects the account even if the password leaks. Switch it on for your email above all, because reset links for every other account land there.
• One password per account: a breach on one site should never open the others.

In a business, the problem is often not the password but who holds it. I explain how to organise ownership of and access to domains, hosting, ad and social media accounts in my guide to digital asset management. For web design projects, I also recommend replacing the admin password together with the client on handover day and saving the new one in their own manager. That way, the password that travelled around during development stops working after launch.

How should a business set its password policy?

For one person a good password is enough; a company needs a policy. The same NIST guideline gives organisations a useful checklist:

• Check every new password against a blocklist of breached, common and expected passwords.
• Let people use password managers, autofill and paste.
• Do not force periodic changes; require a change when there is evidence of compromise.
• Offer multi-factor authentication and limit failed login attempts.

Local rules may add their own requirements, and some regulators or sector standards still expect regular changes. Therefore agree the final policy with your IT and legal teams, and check the current rules for anything critical.

On the website side, how you store and transmit passwords is a separate topic. I cover it in the website data security and encryption guide. In addition, if you run forms or member logins, my article on building a GDPR compliant website completes your checklist.